The vulnerability is a classic SQL injection flaw that allows an unauthenticated attacker to inject arbitrary SQL statements through user-controlled input in the uListing WordPress plugin. Because the plugin verifies no authentication before processing the input, a malicious actor can manipulate database queries, potentially reading, modifying, or deleting data. The weakness falls under CWE‑89 and carries severe confidentiality, integrity, and availability implications.

Affected systems are WordPress sites that use the Stylemix uListing plugin, version 2.2.0 or earlier. The plugin provides listings functionality and is installed by many WordPress administrators. No further version granularity is provided beyond the <= 2.2.0 cutoff.

The vulnerability scores a CVSS of 9.3, indicating critical severity. EPSS data is not available, and the flaw is not listed in CISA’s KEV catalog, though its high score suggests significant risk. The likely attack vector is remote, through crafted HTTP requests directed at the plugin’s endpoints, because the attack does not require user authentication. The combination of high severity, lack of authentication barrier, and the ubiquitous presence of WordPress makes this a high priority threat for site administrators.